Copssh version 4.9.3 comes with an updated Control Panel with following improvements:

• It is now possible to instruct the Control panel not to convert user names to lowercase. If you add the parameter below to the bin/copsshcp.config file, no conversion will find place:

[Options]
LowercaseUsername=0

The default behaviour is still conversion to lowercase.

• A chrooted sftp environment allowing isolated directories (access type Sftp) was only supported if the default service account (SvcCOPSSH) is selected. It is now supported for all kinds of service accounts including domain users.

• Copssh takes a service restart if a chrooted environment (access type Sftp) is specified during user activation, to avoid error messages about improper permissions on a chrooted directory.

Copssh version 4.9.2 contains version 1.0.1h of OpenSSL addressing 6 security vulnerabilities announced recently.

The Secure Shell (SSH) is a different protocol from SSL or TLS.  OpenSSH relies on the OpenSSL library for access to the cryptographic primitives it provides, not for the TLS or SSL implementations.

Copssh is not vulnerable to those flaws.

Copssh 4.9.1 patch 1001 contains version 1.0.1h of OpenSSL addressing 7 security vulnerabilities announced recently. Even if most of the vulnerabilities affects the TLS implementation which are not used by Copssh, SSL/TLS MITM vulnerability (CVE-2014-0224) can affect ssl clients and servers.

Copssh version 4.9.1 installers contain OpenSSL 1.0.1g fixing Heartbleed security vulnerability. Related US-CERT Alert is here.

OpenSSL Security Advisory [07 Apr 2014] - TLS heartbeat read overrun (CVE-2014-0160)
A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.
Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.
Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
1.0.2 will be fixed in 1.0.2-beta2.

Copssh doesn't use TLS and is not vulnerable to a Heartbleed attack.

Copssh 4.9.0 contains OpenSSH 6.6p binaries.

Changes since OpenSSH 6.5

This is primarily a bugfix release.

Security:

* sshd(8): when using environment passing with a sshd_config(5) AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could be tricked into accepting any enviornment variable that contains the characters before the wildcard character.

New / changed features:

* ssh(1), sshd(8): this release removes the J-PAKE authentication code. This code was experimental, never enabled and had been unmaintained for some time.

* ssh(1): when processing Match blocks, skip 'exec' clauses other clauses predicates failed to match.

* ssh(1): if hostname canonicalisation is enabled and results in the destination hostname being changed, then re-parse ssh_config(5) files using the new destination hostname. This gives 'Host' and 'Match' directives that use the expanded hostname a chance to be applied.

Bugfixes:

* ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in ssh -W. bz#2200, debian#738692

* sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace sandbox modes, as it is reachable if the connection is terminated during the pre-auth phase.

* ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum parsing. Minimum key length checks render this bug unexploitable to compromise SSH 1 sessions.

* sshd_config(5): clarify behaviour of a keyword that appears in multiple matching Match blocks. bz#2184

* ssh(1): avoid unnecessary hostname lookups when canonicalisation is disabled. bz#2205

* sshd(8): avoid sandbox violation crashes in GSSAPI code by caching the supported list of GSSAPI mechanism OIDs before entering the sandbox. bz#2107

* ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption that the SOCKS username is nul-terminated.

* ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is not specified.

* ssh(1), sshd(8): fix memory leak in ECDSA signature verification.

* ssh(1): fix matching of 'Host' directives in ssh_config(5) files to be case-insensitive again (regression in 6.5).

Portable OpenSSH:

* sshd(8): don't fatal if the FreeBSD Capsicum is offered by the system headers and libc but is not supported by the kernel.

* Fix build using the HP-UX compiler.